' . "\n" .
- htmlspecialchars($query_base) .
+ htmlspecialchars($query_base, ENT_COMPAT) .
'';
} else {
$query_base = self::formatSql($query_base);
@@ -1309,7 +1309,7 @@ class Generator
}
return '' . "\n"
- . htmlspecialchars($sqlQuery) . "\n"
+ . htmlspecialchars($sqlQuery, ENT_COMPAT) . "\n"
. '';
}
diff --git a/libraries/classes/InsertEdit.php b/libraries/classes/InsertEdit.php
index f5ab9c627e..bbed164dd0 100644
--- a/libraries/classes/InsertEdit.php
+++ b/libraries/classes/InsertEdit.php
@@ -10,6 +10,7 @@ namespace PhpMyAdmin;
use PhpMyAdmin\Controllers\Table\ChangeController;
use PhpMyAdmin\Html\Generator;
use PhpMyAdmin\Plugins\TransformationsPlugin;
+use const ENT_COMPAT;
use const PASSWORD_DEFAULT;
use function array_fill;
use function array_flip;
@@ -2067,7 +2068,7 @@ class InsertEdit
: Util::addMicroseconds(
$current_row[$column['Field']]
);
- $special_chars = htmlspecialchars($current_row[$column['Field']]);
+ $special_chars = htmlspecialchars($current_row[$column['Field']], ENT_COMPAT);
} elseif (in_array($column['True_Type'], $gis_data_types)) {
// Convert gis data to Well Know Text format
$current_row[$column['Field']] = $as_is
@@ -2076,7 +2077,7 @@ class InsertEdit
$current_row[$column['Field']],
true
);
- $special_chars = htmlspecialchars($current_row[$column['Field']]);
+ $special_chars = htmlspecialchars($current_row[$column['Field']], ENT_COMPAT);
} else {
// special binary "characters"
if ($column['is_binary']
@@ -2088,7 +2089,7 @@ class InsertEdit
$current_row[$column['Field']]
);
}
- $special_chars = htmlspecialchars($current_row[$column['Field']]);
+ $special_chars = htmlspecialchars($current_row[$column['Field']], ENT_COMPAT);
//We need to duplicate the first \n or otherwise we will lose
//the first newline entered in a VARCHAR or TEXT column
@@ -2115,7 +2116,7 @@ class InsertEdit
// it's better to set a fields_prev in this situation
$backup_field = '';
+ . htmlspecialchars($current_row[$column['Field']], ENT_COMPAT) . '">';
return [
$real_null_value,
diff --git a/libraries/classes/Message.php b/libraries/classes/Message.php
index 17609d2fba..6ece88e55f 100644
--- a/libraries/classes/Message.php
+++ b/libraries/classes/Message.php
@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace PhpMyAdmin;
+use const ENT_COMPAT;
use function array_unshift;
use function count;
use function htmlspecialchars;
@@ -462,7 +463,7 @@ class Message
if ($param instanceof self || is_float($param) || is_int($param)) {
$this->params[] = $param;
} else {
- $this->params[] = htmlspecialchars((string) $param);
+ $this->params[] = htmlspecialchars((string) $param, ENT_COMPAT);
}
}
diff --git a/libraries/classes/Util.php b/libraries/classes/Util.php
index 5961766213..133d3c95eb 100644
--- a/libraries/classes/Util.php
+++ b/libraries/classes/Util.php
@@ -1524,7 +1524,7 @@ class Util
}
// for the case ENUM('–','“')
- $displayed_type = htmlspecialchars($printtype);
+ $displayed_type = htmlspecialchars($printtype, ENT_COMPAT);
if (mb_strlen($printtype) > $GLOBALS['cfg']['LimitChars']) {
$displayed_type = '';
$displayed_type .= htmlspecialchars(
@@ -1532,7 +1532,8 @@ class Util
$printtype,
0,
(int) $GLOBALS['cfg']['LimitChars']
- ) . '...'
+ ) . '...',
+ ENT_COMPAT
);
$displayed_type .= '';
}